Firecracker VM Escape: PwnEscape Part 2

If you run untrusted code inside AWS Firecracker microVMs, that code can now achieve root access on the host machine.

Researchers at PWN discovered a critical vulnerability in Firecracker, a microVM technology developed by AWS, allowing guest-to-host escape. Dubbed PwnEscape Part 2, the exploit enables arbitrary code execution as root on the host system from within the microVM. The attack leverages a memory primitive to locate the Firecracker process and modify the saved registers of a virtual CPU (vCPU) thread. When the thread returns from the KVM kernel module, it executes attacker-chosen code. This process involves translating guest physical addresses to host physical addresses, identifying the Firecracker process's memory space, and pinpointing the specific vCPU thread's saved register state. The researchers successfully demonstrated redirecting the vCPU thread's execution to a custom `write` syscall, proving the escape by writing a string to the host's stderr.

This vulnerability fundamentally undermines the isolation promises of Firecracker, a core component used by AWS for services like Lambda and Fargate. The ability for code running inside a microVM to escape to the host and execute as root means that any potential vulnerabilities within user applications could be leveraged to compromise the underlying infrastructure. This discovery prompts a re-evaluation of the security guarantees offered by microVMs and necessitates immediate patching by AWS and users of affected services.

The successful exploit highlights the intricate nature of VM escape vulnerabilities, particularly those targeting hypervisor components like KVM and memory management. The research demonstrates a sophisticated chain of attacks, starting from a guest-to-host memory primitive and culminating in control over a live host thread. Security teams should anticipate increased scrutiny on hypervisor implementations and similar isolation technologies, potentially leading to more robust auditing and stricter security controls in cloud environments.